Gem Pad Token Launchpad Hack Drains Liquidity From Munch Protocol, Nutcoin Ecosystem, and More

The Gem Pad token launchpad is posting suspicious transactions, on-chain research shows. The platform for token launches and sales was exploited for an estimated $2.2M.

A recent Gem Pad token launchpad exploit has seen suspicious transactions flagged by on-chain research, with the platform used for token launches and sales being drained to the tune of an estimated $2.2 million.

Gem Pad has been posting suspicious transactions, which have led to an exploit across multiple chains and tokens. The Gem Pad team quickly stepped in to mitigate the hack, stating that several security locks were breached.

IMPORTANT ANNOUNCEMENT

As some of you may have noticed, an incident occurred last night where someone managed to breach our security locks.

We immediately contacted all of our partners and experts in the space to investigate and resolve the situation. The issue has now been…

— ?????d (@TheGemPad) December 17, 2024

The reason for the attack, according to code analysts, was a reentrancy on one of the functions that creates a token lock. The malicious token transfer allowed the attacker to get back the liquidity from several projects.

The tokens affected were from three major chains – Ethereum, Base, and BNB Smart Chain. The flawed entry point was the GempadLock smart contract, which lacked reentrancy protection.

The exploit occurred despite a recent audit by Cyberscope, which gave Gem Pad a high security score, although the flaw was present within a single function in one smart contract.

Following the news of the exploit, the GEMS token slowly retraced to $0.11. The native token of the Gem Pad platform had already declined in the second half of 2024 and now trades at around $0.11.

Gem Pad projects face fallout from stolen tokens

The attacker drained the Gem Pad security locks, which were then swapped for ETH and BNB before being consolidated. According to Gem Pad, only a few projects were affected, and the platform is now secure and back online, except for the Locker service, which will remain unavailable until further notice.

On Gem Pad, token locks are the smart contracts that hold some of the tokens transparently to ensure that they cannot be sold in a rug pull. Launchpads continue to be a tool for distributing new tokens, along with the meme token markets. Launchpad volumes have declined, but Gem Pad has managed to attract a portfolio of projects.

While Gem Pad itself is not compromised, it remained the central point of failure due to the logic in its smart contract, and the affected projects and communities ultimately absorbed the losses.

Five projects hit by drained liquidity

One of the projects that had their token lock attacked was Munch Protocol. However, the protocol stated that its funds were safe and not affected and could be recovered with Gem Pad’s help. Munch Protocol tokens are not yet traded and did not feel the secondary effects of the hack. The protocol did not mention how it managed to keep its funds safe or whether it absorbed any direct losses.

Another project hit by the lock attack was The Nutcoin Ecosystem, which had all of its liquidity drained on Ethereum. At one point, four transactions of 100 ETH were sent directly to Tornado Cash, rendering them essentially unrecoverable.

Anon was another project that had its liquidity drained, with $3.6 million in value being exposed. The Anon community on Base was not affected, and personal wallets were safe. While $2.2 million has been accounted for to date, there could be a larger final tally for all tokens lost.

FOMO Network also stated that its liquidity pool on the launchpad was drained, causing the native FOMO token to crash from $0.004 to $0.00098. The hack also affected the newly launched DUB token by one of Alien Base DEX’s partners, a trading app on the Base chain.

The hack also impacted the liquidity for BPAY tokens, which the attacker sent directly to Uniswap V2 before transforming the haul into WETH. Immediately following the news, BPAY crashed by 75%, falling from $0.004 to $0.001.

Although the Gem Pad hack was relatively minor in terms of the funds stolen, the secondary effects wiped even more liquidity from the market. The loss could also further damage the integrity of the affected tokens and projects.

The attack occurred as Gem Pad was ramping up its activity on Base and posting more content to drive investors to its launchpad projects, with several new launches expected in the coming days, although no word yet on the new method for locking up liquidity.

Land a High-Paying Web3 Job in 90 Days: The Ultimate Roadmap